10 ms·
Does anyone have any information on how Scruff handles that information? Also, does HIPAA say anything about technology companies outside of the medical field's
by werber 9y ago
Does anyone have any information on how Scruff handles that information? Also, does HIPAA say anything about technology companies outside of the medical field's data that may voluntarily collect HIV status?
- dragonwriter 9y ago> Also, does HIPAA say anything about technology companies outside of the medical field's data that may voluntarily collect HIV status? No, HIPAA binds only covered entities, which are (basically) care providers, insurers, and certain other parties in certain business relationships with care providers and insurers. If you give out your health information to a dating service, it's not protected by HIPAA.
- reureu 9y agoThat's not to say there may not be other laws that govern how you protect a user's data though.
- rhizome 9y agoSuch as? I'm not under the impression that there are any legal prohibitions on this kind of thing in the US.
- zoe1337 9y agoThat's the problem.
- DataWorker 9y agoFor now at least...
- reureu 9y agoThe first that comes to mind is the Federal Trade Commission Act, which allows the FTC to charge companies which fail to protect consumer personal data.
- JumpCrisscross 9y ago> HIPAA binds only covered entities Covered entities are specifically defined as: "(1) A health plan"; "(2) A health care clearinghouse"; or "(3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter" [1]. [1] https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/xml/CFR-2017-title45-vol1-sec160-103.xml https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/xml/CFR-...
- your-nanny 9y agoThen why are research institutions included?
- dragonwriter 9y agoThey aren't, as such, however they usually get data through business relationships with providers or payers (or, in many cases, are providers.)
- chimeracoder 9y ago> No, HIPAA binds only covered entities, which are (basically) care providers, insurers, and certain other parties in certain business relationships with care providers and insurers. If you give out your health information to a dating service, it's not protected by HIPAA. This is correct, though it's worth noting that HIV status is actually protected under more strict terms than just HIPAA, and that may in fact apply to Grindr. There are a lot of laws at the state-level which restrict the ability to collect, record, or pass on information related to an individual's HIV status even when none of the parties involved are covered entities (or business associates of covered entities).
- ztoben 9y agoI don't think HIPAA would have any jurisdiction in this area.
- icelancer 9y agoThe "I" in HIPAA seems to go ignored when talking about health data. If that letter doesn't apply, then HIPAA almost certainly doesn't matter.
- jnagro 9y agoI believe HIV status is a special protected piece of information and consent needs to be given before you can share it. http://www.aidslawpa.org/get-help/legal-information/confidentiality/ http://www.aidslawpa.org/get-help/legal-information/confiden...
- kayfox 9y agoThose laws apply to healthcare providers, not to social networks.
- jnagro 9y agoWell, in the case of PA (as an example) i believe they have a `Subsequent disclosure prohibited` portion of their statute which covers anyone who has the data preventing them from further sharing it without consent.
- kayfox 9y agoFor HIV status disclosed as part of medical services. In the case of Grindr, HIV status is voluntarily collected as demographic data for its social network. Its also available to anyone who sees the profile in their search results. As far as I can tell you cant have a profile that is active, use it and not show up in search results.
- sigmar 9y agoFrom Scruff's privacy policy: "For example, we share your device identifier and demographic information with our advertising display and analytics partners." The whole thing seems pretty bad (privacy-wise) https://www.scruff.com/privacy/ https://www.scruff.com/privacy/
- werber 9y agoI don't get why they don't explicitly state HIV status, I'm assuming it's covered in this, "Any other information you voluntarily provide us with in connection with your registering and using the Service.", but again, not 100%.
- esilverberg2 9y agoHi -- See my reply above for a list of what we share. HIV status is not part of this data, and indeed is not something we directly collect.
- esilverberg2 9y agoCEO of SCRUFF here, and daily reader of HN. We have not, do not, and would not share this information with third parties. The data that we share with our third-party ad providers is: - Your location (so you can get those local car dealer ads) - Your gender - Your age - The targeting keyword "gay" We currently use AdMob and MoPub to provide our network advertising. More broadly, this kind of information is never something we would share. We know the sensitivity of HIV status, and know that it has been used to discriminate against our community in the past. When we do take money from direct advertisers (full-screen ads shown at launch), we make sure that they are promoting relevant and beneficial products for our community, and the ads they place are serviced 100% in-app and come with no extra data nor api calls. Ultimately, our business model is based on subscriptions, which means we are successful when we make software that people love to use. We don't spend our days trying to squeeze a marginal penny out of some remainder-bin ad unit by trading personal data of our users. Instead, we spend our time focused on how to make an excellent product, that works reliably, is free of spambots and harassment, and connects gay guys with each other and the global gay community.
- salvar 9y agoHow granular is the location data you share, on the scale from postcode to lat/lon?
- esilverberg2 9y agoFor these third-party ad networks, they accept a lat/lng, so we (and I suspect most apps) just pass in a value obtained from the device. That said, upon further reflection, a local advertiser could surely get enough targeting information with a much, much less precise value...we'll look into making this change in a future release.
- nobody_nowhere 9y agoWeigh that privacy consideration against the value of CPGs looking to spend shopper marketing advertising dollars in-store, just sayin'...